For two straight days someone was running in.ftpd in my server (apparently looking to break in) and when I would do "top" almost every line would read "in.ftpd". I had a unix sysadmin friend of mine shut it down and then start it back up in a day and a half and all seems OK for now.
Here's what I read in order to do this in.ftpd shutdown myself and not have to call on my friend. Is this correct as shown below?
First, decide which service you want to turn off. For the sake of discussion, call it chargen.
su. Enter your root password.
pico/etc/inetd.conf (or use your favorite editor).
Search for chargen (at the beginning of a line).
Comment this line, by inserting a "#" character at the beginning of the line.
Save this file (/etc/inetd.conf), and exit your editor.
Next, we have to tell inetd to reread /etc/inetd.conf. The way of doing this varies from UNIX variant to the next. Some of the ways are described below.
Solaris 2
ps -ef | grep inetd
You can expect to see output like:
root 140 1 0 Aug 19 ? 0:02 /usr/sbin/inetd -s
root 24366 816 0 09:21:03 pts/7 0:00 grep inetd
The line ending in inetd is the line that identifies the pid (or "process id") of inetd. The second column is the pid number itself, or in this case, 140. Ignore the line ending with the grep inetd; it's part of the command that you just issued.
kill -HUP 140 (be sure to fill in the pid from step 3 - don't just use 140 unless that's what your ps -ef | grep inetd identified too)
Thanks for any advice, help, or feedback.